I discovered something I consider a major vulnerability in a SaaS product that includes the username and password in the query string of the URL on registration and every login attempt.
The technical support of the service has told me they consider the vulnerability insignificant, as the only way to exploit it is to gain access to the user's browser history.
Were they correct in their decision? I'm fairly new to information security, but it still sounds like laziness on their part.
I did skim through this question, but having read the most upvoted answer I'm now even more concerned about this being overlooked, as the data is sent via GET and the credentials are displayed in plain text.